diff options
| author | Xinchen Hui <laruence@php.net> | 2015-04-21 21:04:20 +0800 |
|---|---|---|
| committer | Xinchen Hui <laruence@php.net> | 2015-04-21 21:04:20 +0800 |
| commit | 8362aebdbfa15e6afb52b2d46f44228ad08cec5e (patch) | |
| tree | 66cb5c744ee860815a0fb0856ffa09e3fca07d14 /Zend/zend_execute.c | |
| parent | f83ee6a05d9b0213ba43831a5c55ad7992a825c0 (diff) | |
| download | php-git-8362aebdbfa15e6afb52b2d46f44228ad08cec5e.tar.gz | |
Fixed mem leak in assign_to_obj with reference
Diffstat (limited to 'Zend/zend_execute.c')
| -rw-r--r-- | Zend/zend_execute.c | 27 |
1 files changed, 16 insertions, 11 deletions
diff --git a/Zend/zend_execute.c b/Zend/zend_execute.c index cbe6ef1d80..eb37d48522 100644 --- a/Zend/zend_execute.c +++ b/Zend/zend_execute.c @@ -1044,7 +1044,6 @@ fast_assign: } if (!zobj->ce->__set) { - zend_reference *ref = NULL; if (EXPECTED(zobj->properties == NULL)) { rebuild_object_properties(zobj); @@ -1059,11 +1058,22 @@ fast_assign: } else if (value_type != IS_TMP_VAR) { if (Z_ISREF_P(value)) { if (value_type == IS_VAR) { - ref = Z_REF_P(value); - } - value = Z_REFVAL_P(value); - if (Z_REFCOUNTED_P(value)) { - Z_ADDREF_P(value); + zend_reference *ref = Z_REF_P(value); + if (--(GC_REFCOUNT(ref)) == 0) { + ZVAL_COPY_VALUE(&tmp, Z_REFVAL_P(value)); + efree_size(ref, sizeof(zend_reference)); + value = &tmp; + } else { + value = Z_REFVAL_P(value); + if (Z_REFCOUNTED_P(value)) { + Z_ADDREF_P(value); + } + } + } else { + value = Z_REFVAL_P(value); + if (Z_REFCOUNTED_P(value)) { + Z_ADDREF_P(value); + } } } else if (value_type == IS_CV && Z_REFCOUNTED_P(value)) { Z_ADDREF_P(value); @@ -1073,11 +1083,6 @@ fast_assign: if (retval) { ZVAL_COPY(retval, value); } - if (/*value_type == IS_VAR &&*/ ref) { - if (UNEXPECTED(--GC_REFCOUNT(ref) == 0)) { - efree_size(ref, sizeof(zend_reference)); - } - } return; } } |